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(54) A method for generating pseudo-random numbers 



(57) The present invention is a method for outputting 
larger bit size pseudo-random number z f that is crypto- 
graphically secure. Since larger bit size pseudo-random 
numbers are being outputted, larger bit size segments 
of messages may be encrypted resulting in a speedier 
encryption process than encryption processes of the pri- 
or art. In one embodiment, the present invention is a 



pseudo-random number generator defined by a modu- 
lar exponential function x t = g*^ mod p. The output of 
the pseudo-random number generator being a pseudo- 
random number z s comprising a /-1 bit size segment of 
x h The value of j being less than or equal to m-2c(i.e., 
j<m~2c). In an embodiment of the present invention, the 
pseudo-random number ^includes the j least significant 
bits of Xj excluding the least significant bit of x t 
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Description 

Field of the Invention 

s [0001] The present invention relates generally to cryptography and, in particular, to pseudo-random number gener- 
ators. 

Background of the Related Art 

io [0002] Pseudo-random generators are used in some forms of cryptography to provide secured commun ication means 
for the transmission of messages between a transmitter and a receiver. Security is provided such that only an intended 
receiver can understand a message (e.g. , voice or data) transmitted by an authorized transmitter, and only the author- 
ized transmitter can send the message to the intended receiver. The challenge of cryptography is to change a message 
into a form that only the intended receiver can comprehend. This must be done in a way that is both economical for 

is the transmitter and for the intended receiver. At the same time, it must be very difficult (in terms of time and/or processing 
capabilities) for an unauthorized receiver (i.e. , not the intended receiver) to comprehend the message. As unauthorized 
receivers and unauthorized transmitters become; more sophisticated, the need for secured communications become 
greater. 

[0003] FIG. 1 depicts a functional block diagram of a transmitter 10 in the prior art having a cryptographic device for 
20 encrypting messages. The cryptographic device comprising pseudo-random number (PN) generator 12 and XOR op- 
erator 14. PN generator 12 is defined by the following modular exponential function: 
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x t = g M mod p (equation 1) 

wherein x, is a value comprising m bits, p is a prime number comprising k bits, g is a generator of integer mod p, and 
^<i<n. Since equation 1 is a modular exponential function, the value of m should be less than or equal to k (i.e., m<k). 
Value xyis generated initially by providing PN generator 12 with seed value x 0 , which is a secret value comprising m 
bits and known only to the authorized transmitter and the intended receiver. Thus, value Xj is equal to g*o mod p . Value 
x A is used to generate x 2 (i.e., x 2 = g*imodp), which is then used to generate x 3 , and so on. 

[0004] PN generator 12 outputs a pseudo-random number z f comprising a d bit size segment of xj. The pseudo- 
random number z, is then used to encrypt a dbit size segment of a message to be transmitted. Specifically, XOR 
operator 14 receives as inputs the message segment and the pseudo-random number z f The message segment is 
XOR with the pseudo-random number z/to produce a d bit size encrypted message segment. The values of d, m, and 
/cdepend. in part, oh the degree of cryptographic security (or difficulty) soughtto be attained, as will be described herein. 
[0005] Cryptographic security depends on two factors: (I) the degree of difficulty in solving a discrete logarithm prob- 
lem for x r and (2) the degree of difficulty in breaking the pseudo-random number generator given one or more pseudo- 
random numbers z, (comprising d bits). Assuming all m bits of x ; are available, solving a discrete logarithm problem 
for x, involves the determination of x M such that x,= g*M mod p. A discrete logarithm problem is considered compu- 
tationally hard, and therefore cryptograph ically secure; if 2 C number of operations are required to solve it, wherein c 
represents a cryptographic security threshold leveL The standard belief is that a discrete logarithm problem is hard if 
it takes at least 2 s4 number of operations to solve it (i.e., c>64); 

[0006] A discrete logarithm problem can be solved by a variety of techniques. The two most efficient techniques 
being the well-known index calculus technique and square root technique: To solve the discrete logarithm problem for 
Xj using the index calculus technique, it would require 

; v a /log 2 pXlogl log- p ; : . 

operations jnde)( = 0(2 ? ) (equation 2) 

number of operations, wherein a is a constant. If c=64, the hard threshold (of 2 s4 number of operations) is met when 
p comprises at least 51 2 bits (i:e., A>512). Thus, the value selected for k is dependent upon the value of c. By contrast, 
to solve the discrete logarithm problem for x, using the square root technique, it would require 

operations^ = $2™ (equation 3) 

number of operations. If '£=64; the hard threshold is met when X/ comprises at least 128 bits (i.e., m>128) Thus; the 
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value of m is also dependent upon the value of a 

[0007] As mentioned earlier, solving the discrete logarithm problem for x s assumes all m bits of x t are available. If 
only d bit size segments of x,(i.e., pseudo-random number zj) are available, then the predecessor step to solving the 
discrete logarithm problem for x, is to somehow determine all m bits of x t This is the aforementioned second factor of 

5 cryptographic security, which involves breaking the pseudo-random number generator given one or more pseudo- 
random number z v A pseudo-random number generator is considered cryptographically secure if, given one or more 
pseudo-random numbers z h all m bits of x ; would be difficult to predict or determine. It is believed that if the PN generator 
outputs smaller bit size pseudo-random numbers z t (i.e., small segments of x,), less data would be available to a 
cryptanalyst to use to predict any other bits of x r The exact size of pseudo-random number z- t being outputted would 

10 depend on the degree of cryptographic security sought to be attained - that is, the value of d is dependent upon the 
value ofc. 

[0008] Blum-Micali presented a PN generator which outputted pseudo-random numbers z t comprising only the most 
significant bit of x p i.e., d=l. Blum-Micali showed that the degree of difficulty in breaking this PN generator is equivalent 
to the degree of difficulty in solving a discrete logarithm problem for the modular exponential function of x t Thus, if 
15 solving the discrete logarithm problem for x,- is hard, then breaking Blum-Micali's PN generator (outputting pseudo- 
random numbers z, comprising only the most significant bit) is also hard. 

[0009] By contrast, Peralta presented a successor PN generator which outputted pseudo-random numbers Zj com- 
prising log2 m most significant bits, i.e., d=!og 2 m. For example, if x, comprises 512 bits, then the PN generator would 
output pseudo-random numbers ^comprising no more than the nine (i.e., log2 512) most significant bits of x^ Or if X/ 

20 comprises 1024 bits, then the PN generator would output pseudo-random numbers z- t comprising no more than the 
ten (Le., log 2 1024) most significant bits of x h Peralta showed that the degree of difficulty in breaking this PN generator 
is also equivalent to the degree of difficulty in solving the discrete logarithm problem for the modular exponential function 
of x r Thus, if solving the discrete logarithm problem for x,- is hard, then breaking Peralta's PN generator (outputting 
pseudo-random numbers z f comprising only log 2 m most significant bits) is also hard. 

25 [0010] Although encryption processes that use the PN generators presented by Blum-Micali and/or Peralta are cryp- 
tographically secure, these PN generators output pseudo-random numbers z, comprising no more than log 2 m bits of 
x h Since log 2 m is a relatively small value, only small bit size segments of messages can be encrypted for every pseudo- 
random numbers z, outputted by the PN generator. This results in a slower encryption process because more pseudo- 
random numbers z { have to then be outputted to encrypt the entire message. Accordingly, there exists a need for a 

30 pseudo-random number generator that outputs lager bit size pseudo-random numbers z, and is cryptographically se- 
cure. 

Summary of the Invention 

35 [0011] The present invention is a method for outputting larger bit size pseudo-random number z,that is cryptograph- 
ically secure. Since larger bit size pseudo-random numbers are being outputted; larger bit size segments of messages 
may be encrypted resulting in a speedier encryption process than encryption processes of the prior art. In one embod- 
iment, the present invention includes a pseudo-random number generator defined by a modular exponential function 
X| = mod p, wherein X/ is a value comprising m bits, p is a prime number comprising k bits, g is a generator of 

40 integer mod p, m<k, and 1<i<n: The values of m and k being selected to make solving the discrete logarithm for the 
modular exponential function of x } hard. The output of the pseudo-random number generator is a pseudo-random 
number z, comprising a/-1 bit size segment of x t The value of /being less than or equal to m-2c (i.e., j<m-2c). In an 
embodiment of the present invention, the pseudo-random number z,- includes the j least significant bits of X/ excluding 
. the least significant bit of x h The output of the pseudo-random number generator is then used to encrypt an equal size 
.45 segment of a message to be transmitted. — 

[0012] Advantageously, the present invention uses larger bit size pseudo-random numbers z, to encrypt messages, 
thus resulting in an encryption process that is faster than encryption processes of the prior art that use smaller bit size 
pseudorandom numbers z^e.g.^ pseudo-random numbers comprising log^-mbits). Although the use of larger bit size 
pseudo-random numbers is counter intuitive to prior art cryptographic security beliefs with respect to breaking the 

50 pseudo-random number generator, the present invention utilization of larger bit size pseudo-random numbers z,is 
cryptographically secure. Specifically, the degree of difficulty in breaking the pseudo-number generator of the present 
invention is equivalent to the degree of difficulty in solving the discrete logarithm for a short exponential function y = 
mod p, wherein y is a value comprising m bits, s is a short exponent comprising 2c bits, p is the prime number 
comprising k bits, g is the generator of integer mod p, c represents a cryptographic security (or difficulty) threshold 
.55 level, and 2c«m<fc The values of cand /cbeing selected to make solving the discrete logarithm for the short exponential ; 
function of y hard. : / : ' • : V>- 
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Brief Description off the Drawings 

[001 3] The features, aspects, and advantages of the present invention will become better understood with regard to 
the following description, appended claims, and accompanying drawings where: 

5 

FIG 1 depicts a functional block diagram of a transmitter in the prior art having a cryptographic device for encrypting 
messages; 

FIG. 2 depicts a functional block diagram of a transmitter comprising a cryptographic device for encrypting mes- 
sages used in accordance with the present invention; and 
io FIG. 3 depicts a diagram of the pseudo-random generator of FIG. 2 generating a value x ; and outputting thej least 

significant bits excluding the least significant bit. 

Detailed Description 

*s [0014] FIG. 2 depicts a functional block diagram of a transmitter 20 comprising a cryptographic device for encrypting 
messages used in accordance with the present invention. The cryptographic device comprising pseudo-random 
number (PN) generator 22 and XOR operator 24. PN generator 22 is a device for outputting pseudo-random numbers, 
such as an n stage maximal length shift register or an ASIC executing a pseudo-random number generator program. 
PN generator 22 is defined by the following modular exponential function: 

20 

x,. ■*.•/.•■„,...;•■ : v ' 

x, = g modp (equation 4) 



2S 
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wherein x t is a value comprising m bits, p is a prime number comprising k bits, g is a generator of integer mod p: and 
1<*<n Since equation 4 is a modular exponential function, the value of m is less than or equal to k (i.e., m£/k). \ 
[0015] The values of m and k are chosen such that it would be difficult or hard to solve a discrete logarithm problem 
for the modular exponential function of x/ using any of the well-known techniques for solving discrete logarithm prob- 
lems: such as the index calculus technique and the square root technique, wherein difficulty or hardness is expressed 
in terms of requiring 2° number of operations to solve the discrete logarithm problem and c represents a cryptographic 
security threshold level. Specifically, the value oik should be chosen such that 2 C is approximately equal to or less than 

o/log 2 pxlog 2 log 2 p 

0(2 ). \ ' \o; 

55 and the value of m should be chosen such that 2 C is approximately equal to or less thank Vi™. For example; if the 
degree of difficulty sought to be attained is at least 2^ (i.e., c>64), then Ac> 512 and /n>128. 

[0016] Value X; is generated initially by providing PN generator 22 with seed value x 0 , which is a secret valUe com- 
prising m bits and known only to the transmitter 20 and an intended receiver. Thus, x 1 is equal to p^ mod p. Value x, 
is used to generate x 2 (i.e., x 2 = g*i mod p), which is then used to generate x 3 , and so on. Although PN generator 22 
generates all m bits of x h it only outputs pseudo-random numbers z 9 comprising a >-1 bit size segment of Xf The value 
of y being some value less than or equal to m-2c. In one embodiment, the pseudo-random number z ; comprises the / 
least significant bits of ^ excluding the least significant bit of x/(i.e. s x t segment includes the second least significant 
bit of Xj through the /th least significant bit of xjf. See FIG. 3, which depicts a diagram of the pseudo-random generator 
22 (defined by equation 4) generating a value x ; and outputting they least significant bits excluding the least significant 
bit. For illustrative purposes, the remainder of this application will be described herein with respect to a pseudo-random 
number generator that outputs pseudo-random numbers z l comprising the second least significant bit of x,- through 
thejth least significant bit of x t This should not, however, be construed to limit the present invention in any manner. V 
[0017] As described in the section entitled "Proof below, the degree of difficulty in breaking this PN generator (which 
outputs, for example, the second throughjth least significant bits of x,) is equivalent to solving a discrete logarithm 
problem for a short exponential function V ? • 

v : ••• ,: - : y= g*mod p : ^ V (equation s) 
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wherein y is a value comprising m bits, s is a short exponent comprising 2c bits, p is the prime number comprising k 
bits, and g is the generator of integer mod p. Since equation 5 is a short exponential function, the value of 2c is typically 
much less than the values of m and /c (i.e., 2c«m</r). 
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[0018] If thediscrete logarithm problem for the short exponential function of y is difficult to solve, then the PN generator 
of the present invention is difficult to break. The values of cand /care chosen such that it would be difficult to solve the 
discrete logarithm problem for the short exponential function of y using any of the well-known techniques for solving 
discrete logarithm problems, such as the index calculus technique and the square root technique. For example, suppose 

s the degree of cryptographic security sought to be attained is at least 2 s4 (number of operations) to solve the discrete 
logarithm problem for y. Then the value of k should be at least comprise 51 2 bits and m should at least comprise 128 
bits - that is, if /c>512 and m>128, then at least 2 s4 number of operations are required to break the pseudo-random 
number generator of equation 4 outputting thej least significant bits excluding .the least significant bit. If at least 2 s4 
number of operations are also required to solve the discrete logarithm problem of equation 4, then 2X2 64 (i.e., 2 s5 ) 

10 combined number of operations are required to solve both discrete logarithm problems (forx,and y). Since PN generator 
22 is defined by a modular exponential function (of equation 4), then the value of m could be as large as the value of. 
k. If the value ofk is 512 (or 1024), then the value of m could be as large as 512 (or 1024). Accordingly when k is 512 
(or 1024) and c is 64, PN generator 22 can output pseudo-random numbers z f as large as 383 (or 895) bits, which is 
substantially larger than the bit sizes of the pseudo-random numbers being outputted by prior art PN generators. 

is [0019] PN generator's 22 output (i.e., pseudo-random number Zj) is provided as input to XOR operator 24, which is 
a device for performing XOR operations, such as an XOR gate or an ASIC executing an XOR operation: XOR operator 
24 receives PN generator 22's output and XORs it with an equal size segment of a message to produce an encrypted 
message segment comprising /-1 bits, as shown in FIG. 3. Note that XOR operator 24 may be replaced with any other 
device for combining the bits of the PN generator's output with the bits of the message. 

20 [0020] The encrypted message is subsequently transmitted by the transmitter 20 to a receiver comprising a pseudo- 
random number generator defined by the same exponential function and an XOR operator. If the receiver is the intended 
receiver, the seed value x 0 would be known or determinable by the receiver. Thus, the intended receiver would be able 
to generate the same pseudo-random numbers z, as those generated by the transmitter. The pseudo-random numbers 
Zj could then be used to decrypt the encrypted message segments, therefore allowing the intended receiver to com- 

25 prehend the transmitted message. 

Proof 

Introduction 

30 • ■• ' - -. ' • 

[0021] A function f is said to be one way if it is easy to compute but hard to invert. With appropriate selection of 
parameters, the discrete exponentiation function over a finite field, g* mod p where g is a generator of the cyclic group 
of non zero elements in the finite field, is believed to be a one way function. The intractability of its inverse, thediscrete 
logarithm problem, is the basis of various encryption, signature and key agreement schemes. Apart from finite fields, 

35 other finite groups have been considered in the context of discrete exponentiation. One such example is the group of 
points on an elliptic curve over a finite field. Koblitz and Miller (independently) [Ko], [Mil], considered the group law on 
an elliptic curve to define a public key encryption scheme suggesting that elliptic curve addition is also a one way 
function. Another number theoretic problem that is considered to be hard is the problem of factoring integers. Examples 
of functions relying on factoring which are believed to be one way are the RSA and Rabin functions. Closely related , 

40 to factoring is the problem of deciding quadratic residuosity modulo a composite integer. 

[0022] A concept which is intimately connected to one way functions is the notion of hard bits. Based on one way 
functions, Blum & Micali were the first to introduce the concept of hard bits. Informally, a hard bit B(.) for a one way 
function f (.) is a bit which is as hard to compute as it is to invert f . Blum and Micali showed that the most significant bit 
is a hard bit for the discrete logarithm problem over a finite field. To be precise s their notion of most significant bit 

45 corresponds to the Boolean predicate which is one if the index of the exponent is greater than (p-1 )/2 and zero otherwise. 
They defined and proved this hard bit and successfully used it to show the importance of hard bits in secure pseudo 
random bit generation. Soon after, the hard bits of RSA & Rabin functions were also discovered by Ben-Or-et al [BCS] 
, which led to a new secure pseudo random bit generator. In 1986, Blum, Blum and Shub [BBS] used the quadratic 
residue problem over a composite integer to design yet another secure pseudo random bit generator. Their work was 

so based on the security of the quadratic residue problem which was investigated by Goldwasser and Micali [GM84]. 
Later Goldreich and Levin [GL] proved that all one way functions have a hard bit. More generally they were able to 
show that for any one way function a logarithmic number of one bit hard predicates exist. This in particular proves ther 
existence of at least a logarithmic number of secure pseudo random bit generators attached to a given one way function. 
The use of pseudo random bits in cryptography relates to one time pad style encryption and bit commitment schemes; 

55 tonameafew 

[0023] All the above generators based on one bit predicates suffer from the same problem, namely they are too slow. 
All of them output one bit per modular exponentiation. The concept of simultaneous hardness is the first step in speeding 
things up. Intuitively, the notion of simultaneous hardness applied to a group of bits associated to a one way function 
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f states that It is computationally as hard as the inverse of the one way function to succeed in computing any information 
whatsoever about the given group of bits given only f(x). Using this notion one can extract collections of bits per oper- 
ation and hence the speed up. Long and Widgerson [LW] were the first to show that log log p bits of the discrete log 
modulo a prime number p are simultaneously hard. On the other hand the works of vazirani and Vazirani [VV] and 

5 Alexi-et al [ACGS] address the notion of simultaneous hardness of RSA and Rabin bits. Later Kaliski showed individual 
hardness of bits (in the Blum Micali sense) of the elliptic curve group addition problem using a novel oracle proof 
technique applicable to any finite Abelian group. His methods extend to show simultaneous hardness (stated but not 
proved in the paper) of log n bits where n is the order of the group, [Ka]. More recently, Hastad, Schrift and Shamir 
[HSS], have designed a much more efficient generator which produces n/2 bits per iteration where n is the number of 

io bits of the modulus. The one way function they have considered is the discrete exponentiation function modulo a 
composite integer (to be precise a Blum integer). Once again the method of generation relies on the proof that n/2 bits 
of every iteration are simultaneously hard. The use of a composite modulus allows them to relate individual and simul- 
taneous hardness of bits to factoring the modulus. In all these works the common strings are the results of Yao contained 
in his seminal work [Y] which laid the foundations to a complexity theoretic approach to cryptography which paved the 

15 way for a quantification of security in terms of known hard problems. 

[0024] In this paper we construct a very efficient cryptographic pseudo random bit generator attached to modular 
exponentiation in a finite field. We show that n-0(log n) + bits of every iteration are simultaneously secure where 0(log 
n)+ is equal to the smallest non polynomial quantity in log n. Hence each iteration produces more bits than any other 
method discovered so far. The novelty in this work is to relate the security of the random bit generation to the problem 

20 of solving the discrete logarithm with short exponents. The motivation for this technique is derived from the above 
mentioned work of Hastad-et al where although they are using a modular exponential function modulo a composite, 
the security of the system is related to factoring the underlying modulus. In a similar but not so obvious sense, we use 
exponential in a finite field for the generation but relate the security to the strength of the discrete log problem (over 
the same prime modulus) but with short exponents. In this paper an oracle for the i-th bit gives the value of i-th bit when 

25 the binary representation is used for the argument This is a different representation of the i-th bit than that used by 
Blum-Micali and Long-Widgerson. Also, our representation is the same as the representation that Hastad-et al have 
considered. The paper is organized as follows: In section 2 we discuss the discrete log problem and in particular the 
short exponent discrete log problem. Details of the oracles and hardness of bits are formalized in this section. In section 
3 we show that the trailing n-0(log n) + bits are individually hard with respect to the discrete logarithm problem with 

30 short exponents. In section 4 we prove simultaneous hardness of n-0(log n) + bits. Once again this is with respect to 
the discrete log with short exponents problem. In section 5 we discuss the design of the system and provide the proof 
of security and conclude in section 6. In the appendix, we discuss some extensions of this work to include other Abelian 
groups and possible ways to improve the efficiency of the pseudo random generator. 

35 The Discrete Logarithm Problem 

[0025] We first define the discrete logarithm problem. Let p be a prime and g a generator for (Z/(p))*, the multiplicative 
cyclic group of nonzero elements in the finite field of order p. Then for 1 <= x <= (p-1 ) the function g* mod p defines a 
permutation. 

40 

Problem 1 



[0026] The discrete logarithm problem is to find x given y in (Z/(p))* such that g* mod p = y. Let n = log p be the length 
of p in binary, then g* mod p is computable in Poly (n) time. However, there is no known deterministic or randomized 

45 algorithm which can compute the discrete logarithm in Poly (n) number of steps. The best algorithm to compute the 
discrete logarithm in a finite field of order p, is the index calculus method. Even this is not feasible if p is appropriately 
large (e.g. 1024 bits) since the complexity is sub-exponential and not polynomial in n. On the other hand for primes 
such that (p-1 ) consists of only small factors, there are very fast algorithms whose complexity is equal to the complexity 
of the discrete log in a field whose cardinality is equal to its largest prime factor- This algorithm is due to Pbhlig and 

so Hellman[PH]. v 

Discrete Logarithm with Short Exponents 

[0027] For efficiency purposes the exponent x is sometimes restricted to c bits (c=1 28 or 160 bits) since this requires 
55 fewer multiplication. There are square root time algorithms to find x in square root of c steps, due to Shanks [Sh] and 
Poliar [Po]. Thus c should be at least 128 bits to provide 64 bits of security. By this we mean an attacker should perform 
at least 2 s4 number of operations in order to crack the discrete logarithm using these algorithms. At the moment, there 
is no faster way to discover the discrete logarithm even with x so restricted. 
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[0028] We will also restrict x, in particular, we will restrict it to be slightly greater than 0(log n) bits, but not to save 
on multiplication. The exact size of the exponent will be denoted 0(log n) + , where the superscript + indicates that it is 
greater than any polynomial in log n. Hence even with the square root attack one needs greater than 2°< lo 9 n > steps or 
greater than a polynomial in n number of steps. 
5 [0029] The hard problem we consider in this paper is the inverse of this special case of the discrete exponentiation 
function. To be precise, we consider the case of modular exponentiation in a finite field of order p (a prime number) 
with short exponents. The inverse of this problem is the discrete logarithm with short exponents (DLSE). In other words: 

Problem 2 

10 

[0030] Let p be a large bit prime which has at least one large prime factor. Let x be an integer which is significantly 
. smaller compared to p. Let g be a generator of the cyclic group of nonzero elements in the finite field of integers modulo 
the chosen prime p. Given g and g x =y, find x. 

[0031] The DLSE problem has been scrutinized and a summary of the results are presented in [OW], where they 
is study this problem in the context of the Diffie-Hellman key agreement scheme. The use of short exponents in the Diffie- 
Hellman protocol is to speed up the process of exponentiation. Typically the cost of computing 9/ is linearly related to 
the bit length of x : hence real-time computing costs have motivated the use of low order exponents. Care is necessary 
to ensure that such optimizatbns do not lead to security weaknesses. The above mentioned paper [OW], presents a 
set of attacks and methods to rectify the situation: In particular their conclusions suggest the use of safe primes. 
20 [0032] Another example of the use of shorter exponents is in the generation of digital signatures. The digital signature 
standard (DSS) published by the NIST [DSS] is based on the discrete logarithm problem. It is a modification of the 
EIGamal signature scheme [EG]. The ElGamal scheme usually leads to a signature having 2n bits, where n is the 
number of bits of p (the modulus). For potential applications a shorter signature is desirable. DSS modifies the ElGamal 
scheme so that a 160 bit message is signed using a 320 bit signature but computations are all done modulo a 512 bit 
2s prime. The methodology involves the restrictions of all computations to a subgroup of size 2 160 . The assumed security 
of the scheme is based on two different but very related problems. First of these is the discrete log in the entire group 
which uses a 512 bit modulus, where the index calculus algorithm applies. The second is the discrete log problem in 
the subgroup of the cyclic group of nonzero elements in the finite field. Here Shanks's square root algorithm reduces 
the complexity to 0(23°) since the exponent is only 160 bits. 

30 

Hardness of Bits 

[0033] As indicated in the introduction, the notion of hard bits is very characteristic of every one way function. In 
particular hardness of bits with respect to the discrete logarithm has been extensively studied. In this paper we define 
35 a mild variation of hard bits. 

Definition 1 

[0034] Let f and f be one way functions, where R_f is the range off. Let B: RJ to {0, 1 } be a Boolean predicate. Given 
40 f(x) for somex, the predicate B(x) is said to be f-hard if computing B(x) is as hard as inverting V. 

[0035] Normally when we discuss hard bits, f andf are the same. For example, discovering the Blum-Micali bit is as 
hard as computing the discrete logarithm: But in this paper we allow f and V to be different: An example of this new 
phenomenon, is discrete exponentiation modulo a composite modulus. Here the discrete logarithm in the ring of integers 
modulo a composite is a hard function, and so is factoring. Here given g* for some fixed g and generic x* finding 
45 individual bits of this discrete logarithm is as hard as factoring. This was proved by Hastad-et al in [HSS]. In this paper 
we consider a similar situation. We consider the one way function of discrete exponentiation, but we prove that the n- 
i O(log n) + bits of the exponent are DLSE -simultaneously hard. The best previous result showed simultaneous hardness 
of n/2 of the bits [HSS], but our result shows simultaneous hardness for almost all the n bits. Our results are maximal 
as far as the discrete logarithm is concerned. In other words if in any iteration we drop only O(log n) bits, then any 
50 attacker can compute the seed of the generator by making a polynomial number of guesses. Hence one cannot improve 
on these results regarding number of bits produced per iteration any further. 

Binary Representation 

55 [0036] The number x can be represented in binary as b n . 1 2 n " 1 + b n _ 2 2 n_2 + . .... +b l 2+b 1 where bj is either 0 or 1 The 
i-th bit problem is to discover the value of b } of x. The i-th bit is hard if computing it is as difficult as computing the entire 
logarithm. If we had an oracle, OHg.p.y), which outputs the value of bj then the bit is hard if there is a Poly(n) time 
algorithm which makes Poly(n) queries to the oracle O^p, Y) for various values of Y and computes the entire value 
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of x. We know the least significant bit is not hard because there is a Poly (n) time algorithm to compute it, namely by 
computing the Legendre symbol. 

[0037] An imperfect oracle, 0_epsilon(p,g, Y), is usually defined as an oracle which outputs the correct bit value with 
probability greater than 1/2 + 1/Poly (n). 

5 

Blum-Micali Representation 

[0038] In this paper, we will use the binary representation when we discuss the security of the i-th bit, however, we 
want to mention another interpretation of i-th bit. Blum-Micali introduced a particular bit predicate, B(x) and showed its 
10 hardness. B(x) is 0 if 0 <= x ,<= p-1/2 and B(x) is 1 if p-1/2 < x <= p-1. This is sometimes referred to as the most 
significant bit of x and it is clearly different from the most significant bit of x under the binary representation. Others 
[LW] have extended the definitions to define the k most significant bits. Often the Blum-Micali representation is used 
to refer to the most significant bits, while the binary representation is used for the least significant bits. In this paper 
we will use the binary representation when referring to the i-th bit, unless specified otherwise. 

15 ■ 

Individual Hardness of Bits 

[0039] In this section, we discuss the security of the trailing n-0(log n) + bits, where 0( log n) + is as defined earlier. 
To be precise we show that except the least significant bit all the n-0(log n) + lower bits are individually hard with 
respect to the DLSE problem. Based on definition 1, this amounts to proving the bits of the discrete logarithm are 
DLSE-hard. 

[0040] Let O j (g,y,p) be an oracle which gives the i-th bit (for any i in [2;n-0(log n) + ]. Note that i increases from right 
to left and i=1 for the least significant bit. Given this oracle we show that in polynomial number of steps we can compute 
the short exponent discrete logarithm. In addition, we prove hardness of individual bits by showing that given 0 epsilon 
(g,y,p) with epsilon advantage to predict the i-th bit (for any i in the prescribed range) which runs in polynomial time, 
we can turn this into an algorithm to compute the discrete logarithm of a short exponent by making polynomial number 
of queries to this oracle. For the rest of the paper we will refer to lower k bits to mean lower k bits excluding the least 
significant bit, for any k. 

30 Theorem 

[0041] The lower n-0(log n) + bits are DLSE - individually hard. 

[0042] Prool: According to definition 1 , it is enough to show that given 0"(g,y,p) we can compute log y for all y such 
that x=log y is a short exponent. Without loss of generality, let us assume that p-1=2q, where q is an odd integer. 

35 ' . . - .-.v,q 

(a) Perfect Oracles - O'fg.y.pJ.We are given g* and g and we know in advance that x is small (consisting of 0(log 
n) + bits). Now, computing the least significant bit is always easy, via the Legendre symbol. Hence we compute it 
and set it to zero. Let i=2 and suppose we have an oracle for the 2nd bit. If this is a perfect oracle then we compute 
the second bit. Once this is computed then we set it to zero and we will continue to refer to the new number as p*. 

40 Next we compute the square roots of g*. The roots are and g*2+(p-i)/2 where we refer to the former as the 

principal square root. Since the two least significant bits of g* are zero, we know that the principal square root has 
LSB equal to zero (or equivalent^ Legendre symbol one). This albws us to identify the principal square root. Now 
run the oracle on the principal square root and compute the second least significant bit. This bit is really the third 
least significant bit of x. Once again, set this bit to zero and repeat the process. Clearly, in poty(n) steps we would 

45 have computed x one bit at a time from right to left. Now, when i>2 we square g*, (»-1 ) times Then the 2nd LSB 

is at the i-th position, and we run the oracle to compute this bit. Zero this bit and once again compute square roots. 

The principal square root corresponds to the root with LSB equal to zero. Now the (i+1 )-th of x can be computed 
by running the oracle on the principal square root. Continue this process and in k steps where k= log x, we would 
. know x. ■ •.=/ "' ■ :■' : ..*■"■ 

so (b) Imperfect Oracles - O'epsj^fg.y.p). Suppose we have an imperfect oracle which succeeds in finding the i-th bit 

in only epsilon more than fifty percent of the x in (Z/(p))*. Then we can concentrate the stochastic advantage and 
turn this oracle into an oracle which answers any specific instance correctly with arbitrarily high probability. 

[0043] We divide the proof into two parts 

. (i) The lower 2 times 0(log n) bits are individually hard ^ v \ > 
(ii) The middle n-0(Vlog n)'*Mo 2 times 0(log n) bits are individually hard ° • • 
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[0044] (j) Suppose we have an imperfect oracle whose advantage is epsilon, i.e., the oracle can give the correct 
answer on epsilon more than fifty percent of the possible inputs (and we do not know which ones). Then let r_J be a 
sequence of polynomial number of random numbers between 1 and p-1. We run the oracle on g* +r -J where the LSB 
of x is zero. Via the weak law of large numbers, a simple counting of the majority of 1's and O's of the oracle output. 
s (after neutralizing the effect of the random number)for the second LSB yields this bit. Now compute the square roots 
and pick the principal square root as earlier. Once again repeat the process with a fresh set of random numbers to 
discover the next bit. Clearly in poly(n) steps we would have discovered x one bit at a time from right to left. The proofs 
are omitted, and we refer to [Pe] for details. 

[0045] Suppose $i>2$. Then we square $g A {x}$ $M$ times, and repeat the above process and conclude that any 

io oracle which has an $\epsilon$ advantage will lead to a polynomial time algorithm to compute $x$. The only aspect 
that needs additional mention is the fact, when we randomize it is possible that for some $rj$ when we add them to 
the exponent we may exceed $p-1$. We refer to this as cycling. Assuming that we pick our random numbers uniformly, 
then we argue that the probability of this cycling is bounded above by $\f rac{1 }{poly(n)}$ and hence we need to increase 
the number of queries by a certain amount corresponding to the drop in cycling. Once again the details of the proofs 

*5 are omitted and the reader is refereed to Blum-Micali [BH], for the techniques. 

[0046] (ii) The proof of this step is also similar to the second part of the proof of (i) except that one has to set the 
initial $t$ bits to zero by guessing, before we start the randomizing process. Here $t$ is again a poly($\log n$) number 
and hence the probability of cycling is bounded above as earlier. Once again the details are omitted for brevity and will 
be included in an expanded version of this paper. 

20 [0047] Suppose i>2. Then we square g* i-1 times, and repeat the above process and conclude that any oracle which 
has an epsilon advantage will lead to a polynomial time algorithm to compute x. The only aspect that needs additional 
mention is the fact, when we randomize it is possible that for some rj when we add them to the exponent we may 
exceed p-1 . We refer to this as cycling. Assuming that we pick our random numbers uniformly, then we argue that the 
probability of this cycling is bounded above by 1/poly(n) and hence we need to increase the number of queries by a 

2S certain amount corresponding to the drop in cycling. Once again the details of the proofs are omitted and the reader 
is referred to Blum-Micali [BH], for the techniques. 

[0048] (ii) The proof of this step is also similar to the second part of the proof of (i) except that one has to set the 
initial t bits to zero by guessing, before we start the randomizing process. Here t is again a poly(log n) number and 
hence the probability of cycling is bounded above as earlier. Once again the details are omitted for brevity and will be 
30 included in an expanded version of this paper. 

Discrete Logarithm Hides Almost n bits 

[0049] In this section we prove the simultaneous hardness of n-0(log n) + lower bits of the index in modular expo- 
3S nentiation. Intuitively, given a generator g of a finite field of order p, and g* for some x then we show that gaining any 
information about the trailing n-0(log n) + bits is hard Here hardness is with respect to the DLSE problem. In other 
words, for any prime p given a random generator g and a random element g* of the finite field, any information on the 
relevant bits of x can be converted into an poly(n) algorithm to solve the DLSE problem. Now, the phrase gaining any 
information is rather vague, and this is clarified by the concept of simultaneous security which is defined below for any 
40 generic one way function. 

Definition 2 ' •>'■- 

[0050] Let f be a one way function. A collection of k bits, B k M is said to be simultaneously secure for f if B k (*) is easy 
is to compute given x and for every Boolean predicate B an oracle which computes B(B k < x >) correctly with probability 
greater than M> given only f (x) can be used to invert fin Poly(n) time. 

[0051] In this paper we will be employing a modified notion of simultaneous security relative to a possibly different 
one way function. * 

so Definitions. -•' • m ") • . ■;- '.' : : " * /; V i,-^' I j' : 

[0052] Let f and f be one way functions whose range is [0,N] A k bit predicate B k is said to be f simultaneously Hard 
if given f(x), for every non-trivial Boolean predicate B on k bits, an oracle which outputs B(B k <*)) can be used to invert 
fin polynomial time. If Bk is a f hard predicate then we say the bits of Bk( x > are f -simultaneously hard. 
ss [0053] The above definition, although precise, is not easy to apply when understanding simultaneous security. A 
more working definition is provided in definition 4, phrased in the language of the discrete logarithm problem over a 
prime modulus. - ■ \y ■-;•' •*:'.■ ■. 
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Definition 4 

[0054] The bits of the exponentiation function g* mod p at location j <= i <= k are DLSE -simultaneously hard if the 
[j,k] bits of the discrete logarithm of g* mod p are polynomially indistinguishable from a randomly selected [i,k] bit string 
s for random chosen (g, p, g* mod p). In addition any polynomial distinguishability will lead to an oracle which solves the 
DLSE problem in polynomial time. 

[0055] Once again, proving polynomial indistinguishability of a group of bits as above is difficult. But the notion relative 
hardness helps alleviate this problem and in fact leads to a test of simultaneous security. 

10 Definition 5 

[0056] The i th bit, j <= i <= k, of the function gx mod p is relatively hard to the right in the interval [i,k] if no polynomial 
time algorithm can, given a random admissible triplet (g, p, p* mod p) and in addition given the k-i bits of the discrete 
logarithm of g* to its right, computes the i the bit of the discrete logarithm of C* with probability of success greater than 
15 1/poly(n) for any polynomial poly(n) where n=log p. 

[0057] Based on this definition, we have a test for simultaneous security. The statement of this test is the following 
theorem. 

Theorem 1 

20 . 

[0058] Definitions 4 and 5 are equivalent. 

[0059] The proof of this equivalence for non-biased bits is basically the well-known proof of the universality of the 
next bit test due to Yao [Y]. This proof technique is explained in [BH]. Now, using this theorem and the intractability of 
the DLSE problem we show that the trailing n - 0(log n) + bits are simultaneously hard. 

25 

Theorem 2 

[0060] The n - 0(log n) + trailing bits of g* mod p are simultaneously hard, with respect to the DLSE problem; v 
[0061] Proof: It is sufficient to show that every trailing bit of gx is relatively hard to the right in the interval [2,n-0(log 
30 n)+]. Note that, individual hardness of bits does not imply the simultaneous hardness of all bits. Following the definitions 
and theorem above we know that, in order to show simultaneous security, we are allowed to use only a weak oracle: 
given g x , to predict the i* bit of x , all the i-1 trailing bits of the unknown x should also be given to the oracle. This is a 
very hard task in general. 

[0062] Assume the theorem is false. Then, for some i in [2,n-0(log n)+] there exists an oracle which when supplied 

3$ with the trailing i-1 bits of a generic gx succeeds in predicting the I th bit of x with advantage epsilon where epsilon is 
1/poly(n). Now pick an element S=g s where s is a short exponent We can shift s to the left by squaring S the appropriate 
number of times. Since 0 <= i < n-0(log n) + we can shift s by i-0(log n) bits to the left without cycling. Recall, by cycling 
we mean the exponent exceeds p-1 and hence its remainder modulo p-1 replaces the exponent. Now the 2nd LSB of 
s rests on the I th bit and we can run the oracle repeatedly by multiplying by gf mod p where r is a random number 

40 between 0 and p-1. In order to make sure that the probability of cycling is low we may have to set the t=poly(log n) 
leading bits of s to zero which we can exhaustively guess and run the algorithm for each guess. At the end of the 
algorithm we have a candidate and we can see if gc^'^ equals S. If it does then we stop or else repeat the algorithm 
with another guess. Since we will continue to have an epsilon' >= epsilon -1/t advantage we can deduce the bit from 
the oracle in poly (n) time. We know the 2nd LSB of s in this manner. We set that bit to zero, and take the square root 

45 of the number Of the two roots we should pick the one which is the quadratic residue because all the lower bits are 
zero to begin with and hence the square root should have a zero in the LSB. Now the next bit of s is in the i* position 
and we can run the oracle repeatedly to discover this bit and so on to recover ail the bits of s. Note the Oracle is very 
weak unlike the case for the individual bit oracle. The oracle here will tell you the I th bit with epsilon advantage provided 
you also supply ail the i-1 bits to the right of i. However we are able to do this because all the bits to the right of the 

so shifted s are known to be zero, since we started with a short exponent Now we have shown that for every i such that 
2 <= i < 0( log n) we can use this weak oracle to discover s thus we have shown the trailing bits to be simultaneously 
hard provided the function 9 s mod p with s of size 0(log n) + is hard to invert. 

'- Pseudo Random' Bit Generator 

[0063] In this section we provide the details of the new pseudo random bit generator, in particular we extend the 
scheme used by Blum-Micali [BM] to extract more bits. This is the same scheme that Long-Widgerson [LW] used in 
their generator but their output consisted of log n bits per iteration. In our new scheme we produce n-0(log n)+ bits per 
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iteration. Recall from section 2 that the Blum-Micali scheme used a mildly different definition of "bits 0 . We use the same 
definition of bits as Hastad-et al, but we do not encounter the difficulties they did in defining the generation scheme 
since our exponentiation induces a permutation on {Zp}*. 

[0064] NEW GENERATOR : Pick a seed s 0 from {Zp}*. Define s M =g*{sj mod p. At the step (i>0) output the lower 
s n-0(log n)+ bits ofs h except the least significant bit. 

Proof of Security 

[0065] Suppose A is an epsilon-distinguisher of the 1(1 is poly in n) bng output of our generator, then there is a 
10 (epsilon/1 )-distinguisher for any output at the i ,h step. In particular there is a (epsilon/1 )-distinguisher for n-0(log n) bits 
of s 0 . According to our definitions in the previous section, due to Yao [Y], we can use a distinguisher to create a weak 
oracle which will tell us the ft* bit of x provided we also give it the right most i-1 bits of x. 

[0066] Now we note that we can use this to discover x given g* mod p where x is slightly larger than 0(iog n). We 
repeatedly invoke the "oracle" by setting Sq = {g*}{g r }. Thus we can discover the i bit in poly(n) time. 
15 [0067] Using techniques shown in theorem 3 we can discover the entire x. So if the output sequence of our generator 
is epsilon-distinguishable then in poly(n) time we can discoverx of our exponentiation function. Assuming it is intractable 
to invert the function g* mod p where x is slightly larger than 0(log n) bits (i.e., short exponent) then the output sequence 
of our generator is polynomially indistinguishable. 

20 Conclusion 

[0068] We have shown that the discrete logarithm mod a prime p hides n-0(log n) + bits by showing the simultaneous 
hardness of those bits. The hardness in this result is with respect to the discrete logarithm problem with short exponents, 
i.e., DLSE-simultaneously hard (as defined in section 2 of this paper). 

2S [0069] This allows us to extract n - 0(log n) + bits at a time for pseudo random generation and other applications. As 
an example for n of size 1024 bits and s of size 128 bits this allows us to extract almost 900 bits per exponentiation. 
Spoken informally, we note that the security of this example is 2 s4 since it takes C>(2 64 ) for the best known algorithm 
to crack a modular exponentiation with 1 28 bits. Also, if one desires more security at every step then we can decrease 
the number of bits extracted at every stage. This generator outputs the maximal number of bits from a single iteration. 

30 Extracting any more bits in any iteration leads to a prediction of bits - since we would then be dropping 0(log n) bits 
and hence in polynomial number of guesses we would know the complete exponent in every iteration. 
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Appendix - • "w- ■ V.;. 1 

^0 [0071] In this section we discuss some extensions of our results which will be addressed in an extended version of 
this paper . >. 

Improving Efficiency of Computations 

55 [0072] Let us focus on the mechanics of the generator. We start with a finite field, and a generator g of its multiplicative 
cyclic group. Let so be a secret seed. Then we define s i+1 = g/^Sj} iterative ly. The output of the generator are the trailing 
n-0(log n) + bits of Sj for all i>0, where n=log p. 

[0073] Although the number of bits generated per iteration is large, each iteration involves a large exponent and this 
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could impact on the speed of the generator. Instead, we could start with p, g, and so as earlier but at each stage we 
define Sj +1 = g^Sj,} where Sj, = leading 0(log n) + bits of s h This will ensure that at each stage we are using short 
exponents and hence guarantee a significant speed up. This raises some interesting questions. 

5 Question 

[0074] Will this speed impact the security of the generator? 

[0075] Note that when we restrict our exponents we no longer have a permutation. Hence the simple construction 
used here is inapplicable. A possible method of settling this problem is outlined in Hastad et al in the context of discrete 
10 logarithms over composite moduli [HSS]. In particular, exploiting a certain hashing lemma proved in [ILL] they construct 
a perfect extender and the pseudo-random generation is achieved through repeated applications of the extender to a 
random seed. 

Question 

is 

[0076] Is it possible to adapt techniques from [HSS] to short exponent exponentiation in a finite field and guarantee 
a speed up of computations and security? 

Discrete Logarithms in Abel Ian Groups 

20 

[0077] Let G be a finite Abelian group. Let g in G and let y = g* (where x is unknown and we are using the multiplicative 
notation to denote the group operation). The discrete logarithm problem in the subgroup generated by g asks for the 
value of x given g and y. Clearly, the possible values x can take are from 0 to o(g), where o(g) denotes the order of g, 
and the subgroup generated by g is cyclic. 
2S [0078] In this context, Kaliksi [Ka] has shown that under the intractability assumption of the discrete log in the sub- 
group generated by g the individual bits of x are hard. In this paper the Blum-Micali notion of bits is employed, and the 
proof of individual hardness is based on a novel and new oracle proof technique. 

[0079] The main idea being, the identification of bits is based on a correlation function which automatically accom- 
modates cycling and changes in bits due to randomization. In addition, he completely avoids the computation of square 
30 roots which is central to several of the other works on individual bit security This paper also states that log n bits are 
simultaneously hard. Presumably, the techniques of Long-Widgerson once applied in the framework of generic Abelian 
groups yields this result. 

[0080] Now, we note that assuming the discrete logarithm problem with short exponents is also hard in the chosen 
Abelian group our results on simultaneous hardness of the trailing bits are applicable. Here one could adapt the tech- 

35 niques outlined by Kaliski in order to deduce simultaneous hardness. Once this is shown then a pseudo random gen- 
eration scheme can be outlined based on techniques developed by Hastad-et al. The main problem is to address the 
fact that the subgroup generated by g may be a proper subgroup and hence the group operation on g will not produce 
a permutation of the group to itself. The exact details of the simultaneous hardness and the subsequent scheme of 
pseudo random bit generation, will be deferred to an extended version of this paper. This result will be very useful 

40 when applied to elliptic curves over finite fields. 

Bit Commitment Schemes 

[0081] Several cryptographic schemes require the communicating individuals to commit toa certain message without 
45 revealing any information about the contents of the message. Several single bit and multi-bit commitment schemes 
have been presented in the past. Multi-bit schemes which improve the efficiency of existing protocols are outlined in 
[KMO]. An example of a multi-bit commitment scheme based on pseudo random bit generators is Naor*s scheme [Na].; 
In [HSS], Hastad et al present a scheme which directly uses exponentiation modulo a composite integer. But all schemes 
based on pseudo-random generators depend on the efficiency of the generator. Hence the efficiency of the generator 
so presented in this paper suggests that bit commitment schemes can be speeded up. This topic will also be explored later. 
[0082] Although the present invention has been described in considerable detail with reference to cryptography and 
communication, other applications and versions are possible. For example, the pseudo-random number generator may; 
be used for simulations and other cryptographic applications. Therefore, the spirit and scope of the present invention 
should not be limited to the description of the embodiments contained herein. 
55 . 
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Claims 

1. A method of generating pseudo-random numbers using a pseudo-random generator defined by a modular expo- 
nential function x f = g**- 1 mod p , wherein x t - is a value comprising m bits, p is a prime number comprising k bits, g 
is a generator of integer mod p, and 1<*<n, the method comprising the steps of: 

receiving a seed value x 0 comprising m bits; and 

CHARACTERIZED BY 

outputting a pseudo-random number z,- of the value x,- determined using the seed value Xq, the pseudo-random 
number z, including a second least significant bit of the value x, through a jth least significant bit of the value 
x h the valuej being no larger than m-2c, the value c representing a cryptographic security threshold level; and 
combining the pseudo-random number Z/ with a message segment to produce an encrypted message segment. 

wherein the cryptographic security threshold level c is at least 64. 

wherein the value x t comprises at least 51 2 bits 

wherein the value p comprises at least 512 bits. 

5. The method of claim 1, wherein the value x ; comprises at least 1024 bits. 

6. The method of claim 1 , wherein the value p comprises at least 1024 bits. 

7. The method of claim 1 comprising the additional step of: 
generating the value x,-. 

8. The method of claim 1, wherein the message segment comprises >-1 bits. 

9. The method of claim 1 wherein the message segment is combined with the pseudo-random number z/ using an 
XOR binary operation. 



2. The method of claim 1 , 

3. The method of claim 1 , 

4. The method of claim 1 , 
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